Abstract:Traffic classification occupies a significant role in cybersecurity and network management. The widespread of encryption transmission protocols such as SSL/TLS has led to the dominance of deep learning based approaches. In cybersecurity, strong adversaries often complicate their strategies by constantly developing emerging attacks. Meanwhile, security practitioners desire to grasp the reasons for inference results. However, existing deep learning approaches lack efficient adaptation for incremental traffic types and often have less interpretability. In this paper, we propose I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN, an Incremental and Interpretable Recurrent Neural Network for encrypted traffic classification. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN proposes a novel propagation process to extract the sequence fingerprints from sessions with local robustness. Meanwhile, this proposal provides interpretability including time-series feature attribution and inter-class similarity portrait. Moreover, we design I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN in an incremental manner to adapt to emerging traffic types. The I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN only needs to train an additional set of parameters for the newly added traffic type rather than retraining the whole model with the entire dataset. Extensive experimental results show that our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN can achieve remarkable performance in traffic classification, incremental learning, and model interpretability. Compared with other local interpretability methods, our I <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN exhibits excellent stability, robustness, and effectiveness in the interpretation of network traffic data.

An Encrypted Traffic Classification Method Combining Graph Convolutional Network and Autoencoder

An Encrypted Traffic Classification Framework Based on Higher-Interaction-Graph Neural Network

End-to-end encrypted traffic classification with one-dimensional convolution neural networks

Flow-based Encrypted Network Traffic Classification with Graph Neural Networks

CGNN: Traffic Classification with Graph Neural Network

Design of affinity-aware encoding by embedding graph centrality for graph classification

GCN-ETA: High-Efficiency Encrypted Malicious Traffic Detection

TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-grained Encrypted Traffic Classification

I $^{2}$ RNN: an Incremental and Interpretable Recurrent Neural Network for Encrypted Traffic Classification

Few-Shot Encrypted Traffic Classification: A Survey

Encrypted Network Traffic Classification Using Deep And Parallel Network-In-Network Models

I <inline-formula><tex-math notation="LaTeX">$^{2}$</tex-math></inline-formula> RNN: An Incremental and Interpretable Recurrent Neural Network for Encrypted Traffic Classification

GCN-TC: Combining Trace Graph with Statistical Features for Network Traffic Classification

Enhanced Encrypted Traffic Analysis Leveraging Graph Neural Networks and Optimized Feature Dimensionality Reduction

CBD: A Deep-Learning-Based Scheme for Encrypted Traffic Classification with a General Pre-Training Method

Unidirectional Encrypted Traffic Classification: A Survey

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

PacketCGAN: Exploratory Study of Class Imbalance for Encrypted Traffic Classification Using CGAN

An encrypted traffic identification method based on multi-scale feature fusion

TCGNN: Packet-grained Network Traffic Classification Via Graph Neural Networks

SAFSN: A Self-Attention Based Neural Network for Encrypted Mobile Traffic Classification